| Package | Affected versions | Patched versions |
|---|---|---|
| apache commons daemon | = 1.0.3= 1.0.4= 1.0.5= 1.0.6 | |
| tomcat | = 5.5.32= 5.5.33= 6.0.30= 6.0.31= 6.0.32= 7.0.0= 7.0.1= 7.0.10= 7.0.11= 7.0.12= 7.0.13= 7.0.14= 7.0.16= 7.0.17= 7.0.19= 7.0.2= 7.0.3= 7.0.4= 7.0.5= 7.0.6= 7.0.7= 7.0.8= 7.0.9 |
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free